CVE-2018-1245: emc rsa_identity_governance_and_lifecycle Incorrect Authorization
Vulnerability summary
CVE-2018-1245 is a critical (CVSS 9.0) Incorrect Authorization vulnerability in emc rsa_identity_governance_and_lifecycle. EPSS estimates a 2.49% chance of exploitation in the next 30 days, higher than 84.4% of scored vulnerabilities.
Timeline
- 13-07-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
2.49%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.49% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Emc1 product
- rsa_identity_governance_and_lifecycle7.0.1 | 7.0.2 | 7.1.0
Rsa1 product
- rsa identity governance and lifecycleversion 7.0.1, all patch levels | version 7.0.2, all patch levels | version 7.1.0, all patch levels
2 vendors · 2 products